KR20010040075A - Method and apparatus for connecting internet to save IP addresses by using network address translation function - Google Patents

Abstract

PURPOSE: An address-saving Internet connecting method and apparatus using a network address transformation function are provided to save an IP address and designates one server by services with a single IP address in the situation short of the IP address by fixedly recording an IP address and a port number assigned internally in a network of a network of a network equipment desired to be continuously connected from outside the network according to a network address transformation table. CONSTITUTION: When an IP packet is received by an outside an address-saving Internet connecting unit(1), a destination port number of the IP packet is compared to a local network address transformation function port number of a network address transformation table, and if the port number exists at the network address transformation table, a receiving part port number is transformed by using the internal IP address recorded in the network address transformation table and the local network address transformation function port, the receiving part IP address is transformed, and then a check sum is changed(2). If the receiving party port number of the IP packet does not exist at the network address transformation table, the IP packet is discarded, and then, the transformed IP packet reaches a host 1, a destination(3). When a response IP packet to the IP packet received by the host 1 comes inside of the address-saving Internet connecting unit(4), an origination port number of the packet and a port number of the network address transformation table are compared, and then if the origination source port number exists at the network address transformation table, the origination source port number is transformed by using the internal IP address recorded in the network address transformation table and the port, the origination source IP address is transformed, and the check sum is changed(5), and then the transformed IP packet reaches a host 2, a destination. If the origination source port number is not recorded in the network address transformation table, a source port of the IP packet to be transmitted and an internal IP address are recorded in the network address transformation table, the origination source port number is transformed by using the internal IP address recorded in the network address transformation table and the port, the origination source IP address is transformed, and the check sum is changed(5), and then the transformed IP packet reaches the host 2, the destination(6).

Description

Method and apparatus for connecting internet to save IP addresses by using network address translation function}

The present invention relates to an address-saving internet access method and apparatus using a network address translation function, and more particularly, by using an address-saving internet access device including an extended network address translation function registered in advance in a network address translation function table. It can save web address by having web server, mail server, FTP server, telnet server, etc., and it is possible to build server by type in private network with single IP address. The present invention relates to an address-saving internet access method and apparatus using an extended network address translation function that can be easily and inexpensively.

Over the last few years, the Internet has grown so rapidly that today, an unimaginably large number of hosts are connected to the Internet, which requires that hosts be assigned a unique, unique Internet Protocol (IP) address. .

However, the current IPv4 type of Internet architecture has been gradually increasing, and as the Internet-related software industry has evolved, the IP address is depleted when a unique IP address is provided to all hosts newly connected to the Internet. It causes problems. To overcome this limitation of IPv4, a new Internet protocol called IPv6 is in progress, which greatly expands the IP address field length.

However, many difficult problems remain to actually apply and operate new standards such as IPv6 for Internet address system.

1 is a block diagram of a conventional network address translation function.

The existing network address translation (NAT) function will be described in detail with reference to FIGS. 1 and 2A to 2B.

Referring to FIG. 1, a private network using the network address translation function includes a router, a computer, and a hub having a single IP address and a network address translation function, and a web server and a mail server. When building servers such as Mail Server), FTP Server, and Telnet Server, there should be as many IP addresses as the number of servers.

2A to 2B are flowcharts illustrating a conventional network address translation function.

Referring to FIG. 2A, when the IP packet enters the inside of the network address translation function router (step S1), the network address translation table is checked (step S2), and the source port of the IP packet and the following table 1 As shown, the ports in the network address translation table are compared (step S3), and if they are in the network address translation table, the IP packet is changed after changing the source port and the source IP and changing the check sum (step S5) by referring to the table. Arrive at this destination (step S6).

If the source port of the IP packet is not in the network address translation table in step S3, that is, if the port of the network address translation table and the source port of the IP packet are not the same, a new network address translation table is generated (step S4), and then the table is changed. Note that the source port and source IP are changed and the checksum is changed (step S5).

Network Address Translation Function Table Internal IP address port Local network address translation facility port 10.1.1.210.1.5.48: 11113112: 22222223:

Referring to FIG. 2B, when the IP packet comes out of the network address translation function router (step S7), the network address translation table is checked (step S8), and the destination port of the IP packet and the destination port of the IP packet. Compares the local network address translation function port of the network address translation table with the network address translation table (step S9), and if found in the network address translation table, changes the destination port and the destination IP by referring to the network address translation table, and converts the checksum. After the step S11, the IP packet reaches the destination (step S12).

If the destination port of the IP packet is not in the network address translation table in step S9, the packet is discarded (step S10).

Network address translation is a function that converts an IP address of a private network into an IP address of a global network by using an address allocation mechanism, and is used to save an IP address by being embedded in a router or a firewall.

In recent years, as the number of Internet users in SOHO (Small Pffice Home Office) environments, including Internet rooms, increases, the importance of such a network address translation function is increasing.

However, this network address translation function is inaccessible from the external network, which is an advantage in terms of security. However, when a small company or office wants to have a web server or a mail server, external access is allowed. It has to be a disadvantage. Therefore, in order to build a web or mail server, such a server must be installed outside the network address translation function or serviced by an Internet service provider. This can increase the IP addresses you need to use or incur additional costs for service providers.

Therefore, the problem of the conventional network address translation function technology is, first, although the conventional network address translation function has helped to save the IP address, there is a problem that the additional IP address should be obtained when additional servers are constructed. There was a disadvantage in that the maintenance cost increased due to the IP address added during the server construction.

The present invention has been proposed to solve the above problems of the prior art, and an object of the present invention is to use an address-saving Internet access device including an extended network address translation function registered in advance in a network address translation function table. Address-saving Internet access using extended network address translation function that can save IP address and build private network with only one IP address while saving various IP addresses. A method and apparatus are provided.

Another object of the present invention is to provide a computer readable recording medium having recorded the method.

1 is a block diagram of a conventional network address translation function.

2A to 2B are flowcharts illustrating a conventional network address translation function.

3A to 3B are flowcharts illustrating an address saving internet access method according to the present invention.

4 is a flowchart illustrating a network address translation function according to the present invention.

5 is a conceptual diagram of network address translation.

6 is a conceptual diagram of a private network using an address saving internet access device for implementing the present invention.

In order to achieve the above technical problem, an address-saving internet access method having an extended network address translation function according to the present invention is a network system including one or more personal computers and one or more servers. An internet access method for allowing access to the Internet with a public IP address of (a) preventing access to a specific device among the network devices inside the network system, and at least one network device desired to be accessible from the outside at all times. The ports are fixed in advance in the ports and local network address translation function ports of the network address translation table (Table 2) of the address-saving internet connection device, and the internal IP address of the network equipment is expanded in the extended network address translation table (Table 2). Internal IP note Fixedly recorded in advance on, and in step the IP packets to be transmitted coming from the network devices in the interior of the network system; (b) checking the extended network address translation table and comparing a source port of the IP packet to be transmitted with a port of the extended network address translation table; (c) if the source port of the IP packet to be transmitted is not recorded in the extended network address translation table, record the source port and the internal IP address of the IP packet to be transmitted in the network address translation table and then record the network address translation table. If the source port and the source IP of the IP packet to be transmitted are converted using the internal IP address and the port recorded in the packet, the checksum is changed, and if the source port of the IP packet to be transmitted is recorded in the extended network address translation table. Changing a checksum after converting a source port and a source IP of the IP packet to be transmitted using an internal IP address and a port recorded in the extended network address translation table; (d) transmitting the converted IP packet to be transmitted to a destination; (e) incoming IP packets from outside of the network system; (f) Checking the network address translation table, fixedly recording the port of one or more network equipment that wants to always notify the outside of the network device inside the network system to prevent access to a specific device Comparing local network address translation function ports of the expanded network address translation table; (g) if the destination port of the received IP packet is not recorded in the extended network address translation table, the received IP packet is discarded, and the destination port of the received IP packet is recorded in the extended network address translation table. Converting a destination port and a destination IP of the received IP packet and changing a checksum using the internal IP address and the local network address translation port recorded in the network address translation table, if any; And (h) forwarding to a network device which is a destination corresponding to a destination IP address of the converted IP packet.

In order to achieve the above technical problem, an address-saving internet access device according to the present invention comprises a network system including one or more personal computers and one or more servers, wherein the network devices have one public IP address. An internet access device for accessing the Internet, comprising: at least one network device that is desired to be accessible at all times while prohibiting access to a specific device among network equipment inside the network system from outside the network system; Storing an extended network address translation table in which the internally assigned IP address is recorded statically and the internally assigned IP address is recorded in the network system of the network equipment which can be accessed externally only when necessary A memory unit; The destination port of the IP packet received by the network system is compared with the local network address translation port of the extended network address translation table, or the source port of the IP packet to be sent outside of the network system is defined in the extended network address translation table. A comparison unit comparing with the port; Converts a destination port, a destination IP and a checksum of a received IP packet using an internal IP address and a local network address translation function port recorded in the extended network address translation table, or internal IP address of the extended network address translation table; A converter for converting a source port, a source IP, and a checksum of an IP packet to be transmitted using the port; And a transmission unit for transmitting the converted IP packet to an external server as a destination or to a network device inside the network.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

An address-saving internet access method using an extended network address translation function for solving the technical problem of the present invention will be described with reference to FIGS. 3A to 3B. 3A to 3B are flowcharts illustrating an address saving internet access method according to the present invention.

Referring to FIG. 3A, the ports of a desired server are always fixed in advance in the ports of the extended network address translation table (Table 2) and the local network address translation function ports of the address saving Internet access device. The internal IP address of the server is fixed in advance in the internal IP address of the extended network address translation table (Table 2) of the address-saving Internet access device.

When the IP packet enters the inside of the address-saving internet access device (step S16), it checks the expanded network address translation table of the address-saving internet access device (step S17) and translates the source port of the IP packet and the extended network address translation. Comparing the ports in the table (Table 2) (step S18), if it is recorded in the extended network address translation table, the source port and source IP of the IP packet are converted using the internal IP address and port recorded in the table. After changing the checksum (step S19), the converted IP packet is transmitted to the destination (step S21).

If the source port of the IP packet is not recorded in the extended network address translation table, the source port and internal IP address of the IP packet to be transmitted are recorded in the network address translation table (step S20), and then in the network address translation table. Using the recorded internal IP address and port, the source port and the source IP are converted, the checksum is changed, and the translated IP packet is delivered to the destination (step S21).

Referring to FIG. 3B, the ports of the desired server are always fixed in advance in the ports of the extended network address translation table (Table 2) and the local network address translation function ports of the address saving Internet access device. The internal IP address of the server is fixedly recorded in advance in the internal IP address of the extended network address translation table (Table 2) of the address-saving internet access device.

If an IP packet enters the outside of the address saving internet access device with the extended network address translation function (step S22), check the extended network address translation table of the address saving internet access device (step S23). The destination port of the packet is compared with the local network address translation function port of the extended network address translation table. (Step S24).

If a port of the IP packet is recorded in the extended network address translation table, a destination port and a destination IP of the IP packet are determined using an internal IP address and a local network address translation function port recorded in the extended network address translation table. After the conversion, the checksum is changed (step S26), and the IP packet is delivered to the destination server (step S27). If the destination port of the IP packet is not recorded in the network address translation table in step S24, the IP packet is discarded (step S25).

The core of the operation of the extended network address translation function proposed by the present invention is to modify the network address translation table to properly handle the connection request to a specific server.

As can be seen from the above-described network address translation method, IP packets coming from the outside of an address-saving Internet access device with an extended network address translation table are the same by comparing the destination port number with the local network address translation function port number in the table. Only when there is a reference can be entered with reference to the relevant data.

In addition, since there are only a few specific types of servers that you want to attach to an address-saving Internet connection device, the port number associated with the desired web server such as mail, FTP, telnet, etc. (Note, FTP port number: 21, telnet port) Number: 23, mail port number: 25, web server port number: 80) will be fixed to the local network address translation function port number in the extended network address translation table. . Of course, the existing network address translation function is still performed.

The following is an example of an extended network address translation table that fixes the port number of a server that you want to place inside an address-saving Internet access device.

Extended Network Address Translation Feature Table Internal IP address port Local network address translation facility port 10.1.1.210.1.5.48: 2380: 2380:

When using the extended network address translation method, when the operator wants to telnet to an address-saving Internet access device, the port number (23) may overlap, but since this is only used by the operator, change the port number to be used only by the operator. If you do, it will be solved.

The process of making a connection from the host 2 outside the private network to the host 1 inside using the extended network address translation table will be described in detail with reference to FIG. 4.

4 is a flowchart illustrating a network address translation function according to the present invention.

Referring to FIG. 4, when an IP packet comes out of the address saving Internet access device (1), the destination port number of the IP packet is compared with the local network address translation function port number in the network address translation table, and the port number is determined. If it is recorded in the Xiangxi network address translation table (for example, port number 23 of telnet), the destination port number is converted using the recorded internal IP address and local network address translation function port recorded in the network address translation table (23). 23: where the first 23 represents the telnet port number, the second 23 represents the fixed port number), after translating the destination IP address (166.104.226.104) and changing the checksum (2).

If the destination port number of the IP packet is not recorded in the network address translation table, the IP packet is discarded. Then, the converted IP packet arrives at the destination host 1 (3).

In response to the IP packet received by the host 1, a response IP packet (replaces the destination address and the source address in the received packet, and changes the location of the destination port number and the source port number) from the inside of the address saving Internet access device. (④), compare the source port number of the packet with the port number of the network address translation table, and if it is recorded in the network address translation table, use the recorded internal IP address and port recorded in the network address translation table to send the source port. After translating the number (23-> 23), translating the source IP address (10.1.1.2-> 166.104.226.104), changing the checksum (⑤), and the converted IP packet arrives at the destination host 2 (⑥).

If it is not recorded in the network address translation table, the source port and internal IP address of the IP packet to be transmitted are recorded in the network address translation table in the existing network address translation table, and then the internal IP address recorded in the network address translation table; Use the port to translate the source port number (23-> 23), convert the source IP address (10.1.1.2-> 166.104.226.104), then change the checksum (⑤), and the translated IP packet arrives at the destination host 2 (⑥).

The packet change in the extended network address translation is described in detail in Table 3 with reference to the network address translation conceptual diagram of FIG. 5.

Destination address From address Destination port number Source port number … ① 166.104.226.104 138.201.148.165 23 1111 … ② 10.1.1.2 138.201.148.165 23 1111 … ④ 138.201.148.165 10.1.1.2 1111 23 … ⑤ 138.201.148.165 166.104.202.104 1111 23 …

Hereinafter, an address saving internet access device and an embodiment for solving the other technical problem of the present invention will be described in detail with reference to FIG. 6.

6 is a conceptual diagram of a private network using an address saving internet access device for implementing the present invention.

The address-saving internet access device can be used to connect a private network having a single IP address with the Internet. The private network includes an Internet connection unit 9 for connecting an address-saving Internet access device to the Internet, an address-saving Internet access device (NAT router) 10 including a single IP address and a network address translation table, an external user PC 8, It consists of a hub 11, a personal PC 12, and a server 13.

The Internet connection unit 9 is a telephone network using a modem or a dedicated line using a DSU or CSU, LAN, xDSL, or Fiber To The Home (FTTH).

Referring to FIG. 6, the operator can change the port number of a server to which the user wants to be always accessible from the outside of various servers such as a web server, a mail server, an FTP server, and a telnet server. The IP address translation function is fixed in advance in the port, and the internal IP address of the server is fixed in advance in the internal IP address of the extended network address translation table. The extended address translation, which records the port and internal IP address of the server that you want to keep informed at all times while prohibiting access to a specific server, and records the port and internal IP address of a personal computer that can be accessed externally only when necessary. The function table is stored in a memory unit in the address-saving internet access device.

The comparator may be configured to receive an IP packet from the outside of the address-saving Internet access device (NAT router) 10 through the Internet connection 9 from the outside or from the inside of the address-saving Internet access device through the hub 11. Upon entering, the destination port or source port of the received IP packet is compared with the local network address translation function port or port of the extended network address translation function table stored in the memory unit, and the comparison result is output to the conversion unit.

In the case of reception, the conversion unit discards the received IP packet if the destination port of the received IP packet is not recorded in the local network address translation function port of the network address translation function table, and the destination port of the received IP packet. Is recorded in the local network address translation function table of the network address translation function table, the destination port and the destination IP of the received IP packet using the internal IP address and the local network address translation function port recorded in the network address translation function table. Convert and change checksum The converted received IP packet is transmitted to the personal PC 12 or the server 13 which is the destination through the hub 11 at the transmission unit.

On the other hand, in the case of transmission, if the source port of the IP packet to be transmitted is not recorded in the port of the network address translation function table, the conversion unit records the source port and the internal IP address of the IP packet to be transmitted in the network address translation table. After the source port and source IP is converted and the checksum is changed using the internal IP address and the port recorded in the network address translation table, and if the source port of the IP packet to be transmitted is recorded in the port of the network address translation function table Convert the source port and source IP and change the checksum using the internal IP address and port recorded in the table. The converted IP packet to be transmitted is transmitted from the transmission unit to the external server via the Internet connection unit 9.

When network address translation technology was first developed, it was only thought of as an alternative to the problem of IP address exhaustion, and nobody thought it would be useful in a completely different domain. However, even if the Internet environment changes to IPv6, the network address translation function will continue to be used for security or IP address assignment convenience, and may be applied in various areas. As more and more complicated and various forms of Internet access are required, network address translation is becoming an essential function, but it is extremely limited because it cannot be accessed from the outside.

The address-saving internet access method and apparatus using the extended network address translation function proposed in the present invention are a simple and very useful method to overcome these disadvantages, and can be easily applied to routers or firewalls in which the Internet configuration is the core equipment. In addition, network management methods will be very easy. In particular, SOHO users, who are so diverse in shape that it is difficult to predict their future use, will be able to use them properly when constructing a virtual private network that accommodates various needs.

Although the above has been described with reference to a preferred embodiment of the present invention, those skilled in the art will be able to variously modify and change the present invention without departing from the spirit and scope of the invention described in the claims below. It will be appreciated. In addition, the Internet access method according to the present invention can be implemented in hardware or software by those skilled in the art of course.

According to the present invention, in a network system consisting of network devices including one or more personal computers and one director's server, an IP address and a port number assigned internally in a network of a network device which is always desired to be accessible from outside the network By using the address-saving Internet access device with the extended network address translation function, which is fixed in advance in the address translation table, IP address can be saved in the current situation where there is a shortage of IP addresses, and one server per service with a single IP address. It is possible to designate a server inside the router or firewall that wants to inform the outside except for access to this specific server, which makes it easy and inexpensive to configure various networks even with a single IP address. .

Claims (5)

In a network system consisting of network equipment including one or more personal computers and one or more servers, the method for accessing the Internet to allow the network devices to access the Internet with a single public IP address, (a) Address translation table of an IP address assigned internally in the network to one or more network equipment desired to be accessible from the outside at all times while preventing access to a specific device among the network equipment inside the network from outside the network system. Fixedly recording an element of the first item of the network device and recording a port number of the network equipment as an element of the third item of the address translation table; (b) checking the address translation table and comparing an element of the third item with a destination port of the received IP packet when an IP packet is received from outside of the network system; And (c) if the destination port of the received IP packet is not recorded in the address translation table, discard the received IP packet; if it is recorded in the address translation table, the element of the first item recorded in the address translation table; Converting the destination port, the destination IP address and the checksum of the received IP packet using the element of the third item, and then forwarding the converted IP packet to a network device which is a destination corresponding to the converted destination IP address; Internet access method using a network address translation function comprising a. The method of claim 1, (d) fixedly recording an IP address assigned internally in the network to one or more network equipment of the network equipment of the network system that is desired to be accessible from the outside at all times as an element of the first item of the address translation table, and writing the port number. Fixedly recording an element of a second item of said address translation table; (e) if there is an IP packet to be transmitted from the network equipment inside the network system, checking the address translation table and comparing the source port of the IP packet to be transmitted with the element of the second item of the address translation table. step; (f) if the source port of the IP packet to be transmitted is not recorded in the address translation table, record the source port of the IP packet to be transmitted as the element of the second item and the third item of the address conversion table, and Source of the IP packet to be transmitted using the element of the first item and the element of the second item recorded in the address translation table after recording the IP address assigned internally in the network as the element of the first item of the address translation table After translating a port and a source IP address, the translated IP packet is transmitted to a destination corresponding to the translated destination IP address, and if the source port of the transmitted IP packet is recorded in the address translation table, the address translation table After converting the source port and the source IP address of the IP packet to be transmitted using the element of the first item and the element of the second item recorded in the And transmitting the converted IP packet to a destination corresponding to the converted destination IP address. The method of claim 1, The server may include at least one of a web server, a mail server, an FTP server, and a telnet server. In a network system consisting of network equipment including one or more personal computers and one or more servers, the Internet access device that allows the network equipment to access the Internet with a single public IP address, The IP address assigned internally by the network system is fixedly recorded when necessary for at least one network device which is desired to be accessible at all times while prohibiting access to a specific device among the network devices inside the network from outside the network system. A first item in which an internally assigned IP address is recorded in the network system of an externally accessible network device, and a port of one or more servers which wants to be always accessible while preventing access to a specific server from outside the network system. A memory for storing an address translation table comprising a second item and a third item, in which a port is fixedly recorded and a port of a personal computer or a server which can be accessed externally only when necessary; The destination port of the IP packet received from the outside of the network is compared with the element of the third item of the address translation table stored in the memory unit or the source port of the IP packet to be transmitted outside of the network system is stored in the memory unit. A comparison unit for comparing with an element of a second item of the address translation table; Convert the destination port, destination IP and checksum of the received IP packet by using the element of the first item and the element of the third item recorded in the address translation table, or the element and the second item of the first item of the address translation table A converting unit for converting a source port, a source IP, and a checksum of the IP packet to be transmitted using an element of; And And a transmitter configured to transmit the converted IP packet to a destination of the network reference or to a network device that is a destination within the network. A computer-readable recording medium having recorded thereon a program for executing the Internet access method of claim 1 or 2 on a computer.